Security

Ask something
Discussion Locked

Unknown NT workgroup appears in NetNeigh

0 helpful
7 replies

by chipw 1 view

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

We just noticed this morining a new workgroup in Network Neighborhood, one we've never seen before and know nothing about. It is called Autor_trh and in it is one computer named Mok-It. When I try to access Mok-It it asks for a logon name/password, which of course we don't know.

I checked user mgr for unknown users, there are none, and server mgr for any new entries, again there are none. There also are no new trust relationships set up.

Has anyone seen something like this before? We arevery concerned about where this came from, who put it there, etc.

7 replies

by nschulz

Are you hooked up to the Internet?

A new workgroup will show up if a computer is added to the network with that computer name and workgroup name.

User manager and server manager only covers machines in your NT domain not machines on your subnet.

Try using something like tcpdump to learn the IP address of Mok-It.

Thanks Norm

by gigelul

In addition you can check License Manager and Security Event log on your server which authenticate the users or if you have Win9x workstation maybe a user make some changes in network properties or you have a visitor on your site which try to connect his portable computer to network...no more ideas

by mbardeh

possibilities:
1-somebody connect a computer with that specification to your network at the time you check he disconnected(by laptop,...) it will happend when they try to check your net or gathering information illegally!
2-user may check some change on his network setting and make it correct again you only able to find a sign.
3-from internet an intruder tries to hack your network if you have winroute please check its log for username.
majid

by chipw

We found out where this unknown domain comes from - our company bought another recently (a small outfit), and one of the employees who came over from the other company has his pc set up on our network as it's own domain, and he works in another state on the opposite side of the country, and we were not made aware of this new employee.

This discussion is closed to new replies.